sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-9529 Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution

Medium 6.6 Published Updated

High-privilege users can execute arbitrary PHP code via the plugin's setting import functionality, requiring an upgrade to secure versions.

Exploited in the wild
Not known
Login needed
An administrator
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2024-9529?

CVE-2024-9529 is a medium-severity code injection vulnerability in Unknown Advanced Custom Fields Pro, published on 15 Nov 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.

Which versions are affected by CVE-2024-9529?

It affects 1 product.

Products include Advancedcustomfields Advanced Custom Fields.

How do I fix CVE-2024-9529?

No fix has been published for CVE-2024-9529 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-9529 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-9529 exists.

Sources

Also known as GHSA-w9hg-9q36-xm67.

Is CVE-2024-9529 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free